F44 host + Ubuntu 26.04 client, sudo does not work due to missing NOPASSWD: in sudoers

[ebendler]

Describe the bug
After creating and entering a Ubuntu 26.04 toolbox, and sudo operation prompts for a password. This does not work so you cannot add anything to the container.

Steps how to reproduce the behaviour

toolbox create -d ubuntu -r 26.04
toolbox enter ubuntu-toolbox-26.04
sudo apt update

Expected behaviour
apt update works as normal, no prompts

Actual behaviour
sudo prompts for a password, which does not exist

Screenshots
N/A

Output of toolbox --version (v0.0.90+)
toolbox version 0.3

Toolbx package info (rpm -q toolbox)
toolbox-0.3-4.fc44.x86_64

Output of podman version
e.g.,

Client:        Podman Engine
Version:       5.8.2
API Version:   5.8.2
Go Version:    go1.26.1-X:nodwarf5
Git Commit:    5b263b5f5b48004a87caac44e67349a8266d9ef4
Built:         Mon Apr 13 20:00:00 2026
Build Origin:  Fedora Project
OS/Arch:       linux/amd64

Podman package info (rpm -q podman)
podman-5.8.2-1.fc44.x86_64

Info about your OS
Fedora KDE 44

Additional context
Fixed by doing podman exec -it ubuntu-toolbox-26.04 /bin/bash + visduo and adding the "NOPASSWD:" flag to the %sudo group.

Create Log

toolbox --log-level debug create -d ubuntu -r 26.04
DEBU Running as real user ID 361934436
DEBU Resolved absolute path to the executable as /usr/bin/toolbox
DEBU Running on a cgroups v2 host
DEBU Looking up sub-GID and sub-UID ranges for user ebendler
DEBU TOOLBX_DELAY_ENTRY_POINT is
DEBU TOOLBX_FAIL_ENTRY_POINT is
DEBU TOOLBOX_PATH is /usr/bin/toolbox
DEBU Migrating to newer Podman
DEBU Toolbx config directory is /home/ebendler/.config/toolbox
DEBU Current Podman version is 5.8.2
DEBU Creating runtime directory /run/user/361934436/toolbox
DEBU Old Podman version is 5.8.2
DEBU Migration not needed: Podman version 5.8.2 is unchanged
DEBU Setting up configuration
DEBU Setting up configuration: file /home/ebendler/.config/containers/toolbox.conf not found
DEBU Resolving container and image names
DEBU Container: ''
DEBU Distribution (CLI): ''
DEBU Image (CLI): ''
DEBU Release (CLI): ''
DEBU Resolved container and image names
DEBU Container: 'fedora-toolbox-44'
DEBU Image: 'fedora-toolbox:44'
DEBU Release: '44'
DEBU Resolving container and image names
DEBU Container: ''
DEBU Distribution (CLI): 'ubuntu'
DEBU Image (CLI): ''
DEBU Release (CLI): '26.04'
DEBU Resolved container and image names
DEBU Container: 'ubuntu-toolbox-26.04'
DEBU Image: 'ubuntu-toolbox:26.04'
DEBU Release: '26.04'
DEBU Checking if container ubuntu-toolbox-26.04 already exists
DEBU Looking up image localhost/ubuntu-toolbox:26.04
DEBU Resolving fully qualified name for image ubuntu-toolbox:26.04 from known registries
DEBU Resolved image ubuntu-toolbox:26.04 to quay.io/toolbx/ubuntu-toolbox:26.04
DEBU Looking up image quay.io/toolbx/ubuntu-toolbox:26.04
DEBU Resolving fully qualified name for image ubuntu-toolbox:26.04 from RepoTags
DEBU Resolved image ubuntu-toolbox:26.04 to quay.io/toolbx/ubuntu-toolbox:26.04
DEBU Checking if 'podman create' supports '--mount type=devpts'
DEBU 'podman create' supports '--mount type=devpts'
DEBU Resolving path to the D-Bus system socket
DEBU /home/ebendler canonicalized to /home/ebendler
DEBU Resolving path to the Avahi socket
DEBU Resolving path to the KCM socket
DEBU Resolving path to the pcsc socket
DEBU Checking if /media is a symbolic link to /run/media
DEBU Checking if /mnt is a symbolic link to /var/mnt
DEBU Looking up toolbox.sh
DEBU Found /etc/profile.d/toolbox.sh
DEBU Checking if /home is a symbolic link to /var/home
DEBU Creating container ubuntu-toolbox-26.04:
DEBU podman
DEBU --log-level
DEBU error
DEBU create
DEBU --cgroupns
DEBU host
DEBU --dns
DEBU none
DEBU --env
DEBU TOOLBOX_PATH=/usr/bin/toolbox
DEBU --env
DEBU XDG_RUNTIME_DIR=/run/user/361934436
DEBU --hostname
DEBU toolbx
DEBU --ipc
DEBU host
DEBU --label
DEBU com.github.containers.toolbox=true
DEBU --mount
DEBU type=devpts,destination=/dev/pts
DEBU --name
DEBU ubuntu-toolbox-26.04
DEBU --network
DEBU host
DEBU --no-hosts
DEBU --pid
DEBU host
DEBU --privileged
DEBU --security-opt
DEBU label=disable
DEBU --ulimit
DEBU host
DEBU --userns
DEBU keep-id
DEBU --user
DEBU root:root
DEBU --volume
DEBU /:/run/host:rslave
DEBU --volume
DEBU /dev:/dev:rslave
DEBU --volume
DEBU /run/dbus/system_bus_socket:/run/dbus/system_bus_socket
DEBU --volume
DEBU /home/ebendler:/home/ebendler:rslave
DEBU --volume
DEBU /usr/bin/toolbox:/usr/bin/toolbox:ro
DEBU --volume
DEBU /run/user/361934436:/run/user/361934436
DEBU --volume
DEBU /run/avahi-daemon/socket:/run/avahi-daemon/socket
DEBU --volume
DEBU /run/.heim_org.h5l.kcm-socket:/run/.heim_org.h5l.kcm-socket
DEBU --volume
DEBU /media:/media:rslave
DEBU --volume
DEBU /mnt:/mnt:rslave
DEBU --volume
DEBU /run/pcscd/pcscd.comm:/run/pcscd/pcscd.comm
DEBU --volume
DEBU /run/media:/run/media:rslave
DEBU --volume
DEBU /etc/profile.d/toolbox.sh:/etc/profile.d/toolbox.sh:ro
DEBU quay.io/toolbx/ubuntu-toolbox:26.04
DEBU toolbox
DEBU --log-level
DEBU debug
DEBU init-container
DEBU --gid
DEBU 748400513
DEBU --home
DEBU /home/ebendler
DEBU --shell
DEBU /bin/bash
DEBU --uid
DEBU 361934436
DEBU --user
DEBU ebendler
Created container: ubuntu-toolbox-26.04
Enter with: toolbox enter ubuntu-toolbox-26.04

Enter Log

toolbox enter ubuntu-toolbox-26.04
DEBU Starting container ubuntu-toolbox-26.04
DEBU Inspecting container ubuntu-toolbox-26.04
DEBU Entry point of container ubuntu-toolbox-26.04 is toolbox (PID=12640)
DEBU Waiting for container ubuntu-toolbox-26.04 to finish initializing
DEBU Checking if initialization stamp /run/user/361934436/toolbox/container-initialized-12640 exists
DEBU Setting up initialization timeout for container ubuntu-toolbox-26.04
DEBU Following logs for container ubuntu-toolbox-26.04
DEBU Setting up watches for file system events from container ubuntu-toolbox-26.04
DEBU Listening to container, ticker and timeout events
DEBU Handling file system event: operation CHMOD on /run/user/361934436/toolbox
DEBU > Running as real user ID 0
DEBU > Resolved absolute path to the executable as /usr/bin/toolbox
DEBU > TOOLBX_DELAY_ENTRY_POINT is
DEBU > TOOLBX_FAIL_ENTRY_POINT is
DEBU > TOOLBOX_PATH is /usr/bin/toolbox
DEBU > Migrating to newer Podman
DEBU > Migration not needed: running inside a container
DEBU > Setting up configuration
DEBU > Setting up configuration: file /etc/containers/toolbox.conf not found
DEBU > Setting up configuration: file /root/.config/containers/toolbox.conf not found
DEBU > Resolving container and image names
DEBU > Container: ''
DEBU > Distribution (CLI): ''
DEBU > Image (CLI): ''
DEBU > Release (CLI): ''
DEBU > Resolved container and image names
DEBU > Container: 'ubuntu-toolbox-26.04'
DEBU > Image: 'ubuntu-toolbox:26.04'
DEBU > Release: '26.04'
DEBU > Creating /run/.toolboxenv
DEBU > Path /run/host/etc exists
DEBU > Preparing to redirect /etc/host.conf to /run/host/etc/host.conf
DEBU > /run/host/etc/host.conf isn't a symbolic link
DEBU > Redirecting /etc/host.conf to /run/host/etc/host.conf
DEBU > Preparing to redirect /etc/hosts to /run/host/etc/hosts
DEBU > /run/host/etc/hosts isn't a symbolic link
DEBU > Redirecting /etc/hosts to /run/host/etc/hosts
DEBU > Preparing to redirect /etc/localtime to /run/host/etc/localtime
DEBU > /run/host/etc/localtime is a symbolic link
DEBU > Redirecting /etc/localtime to /run/host/etc/localtime
DEBU > Resolved /etc/localtime to /run/host/usr/share/zoneinfo/America/New_York
DEBU > Preparing to redirect /etc/resolv.conf to /run/host/etc/resolv.conf
DEBU > /run/host/etc/resolv.conf is a symbolic link
DEBU > Redirecting /etc/resolv.conf to /run/host/etc/resolv.conf
DEBU > Creating regular file /etc/machine-id
DEBU > Binding /etc/machine-id to /run/host/etc/machine-id
DEBU > Creating directory /run/libvirt
DEBU > Binding /run/libvirt to /run/host/run/libvirt
DEBU > Creating directory /run/systemd/journal
DEBU > Binding /run/systemd/journal to /run/host/run/systemd/journal
DEBU > Creating directory /run/systemd/resolve
DEBU > Binding /run/systemd/resolve to /run/host/run/systemd/resolve
DEBU > Creating directory /run/systemd/sessions
DEBU > Binding /run/systemd/sessions to /run/host/run/systemd/sessions
DEBU > Creating directory /run/systemd/system
DEBU > Binding /run/systemd/system to /run/host/run/systemd/system
DEBU > Creating directory /run/systemd/users
DEBU > Binding /run/systemd/users to /run/host/run/systemd/users
DEBU > Creating directory /run/udev/data
DEBU > Binding /run/udev/data to /run/host/run/udev/data
DEBU > Creating directory /run/udev/tags
DEBU > Binding /run/udev/tags to /run/host/run/udev/tags
DEBU > Creating directory /tmp
DEBU > Binding /tmp to /run/host/tmp
DEBU > Creating directory /var/lib/flatpak
DEBU > Binding /var/lib/flatpak to /run/host/var/lib/flatpak
DEBU > Creating directory /var/lib/libvirt
DEBU > Binding /var/lib/libvirt to /run/host/var/lib/libvirt
DEBU > Creating directory /var/lib/systemd/coredump
DEBU > Binding /var/lib/systemd/coredump to /run/host/var/lib/systemd/coredump
DEBU > Creating directory /var/log/journal
DEBU > Binding /var/log/journal to /run/host/var/log/journal
DEBU > Looking up group for sudo
DEBU > Group for sudo is sudo
DEBU > Modifying user ebendler with UID 361934436:
DEBU > usermod
DEBU > --append
DEBU > --groups
DEBU > sudo
DEBU > --home
DEBU > /home/ebendler
DEBU > --password
DEBU >
DEBU > --shell
DEBU > /bin/bash
DEBU > --uid
DEBU > 361934436
DEBU > ebendler
DEBU > Removing password for user root
DEBU > Creating runtime directory /run/user/361934436/toolbox
DEBU > Configuring Kerberos to use KCM as the default credential cache
DEBU > Configuring Kerberos to use KCM as the default credential cache: directory /etc/krb5.conf.d not found
DEBU > Configuring Kerberos to use KCM as the default credential cache: skipping
DEBU > Configuring PKCS #11 to read from the host
DEBU Handling file system event: operation CREATE on /run/user/361934436/toolbox/container-initialized-12640
DEBU Handling file system event: operation CHMOD on /run/user/361934436/toolbox/container-initialized-12640
DEBU Received an error while following the logs: context canceled
DEBU Received an error while following the logs: EOF
DEBU Container ubuntu-toolbox-26.04 is initialized
DEBU Checking if 'podman exec' supports disabling the detach keys
DEBU 'podman exec' supports disabling the detach keys
DEBU Creating list of environment variables to forward
DEBU COLORTERM=truecolor
DEBU CONTAINERS_STORAGE_CONF is unset
DEBU DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/361934436/bus
DEBU DBUS_SYSTEM_BUS_ADDRESS is unset
DEBU DESKTOP_SESSION=/usr/share/wayland-sessions/plasma.desktop
DEBU DISPLAY=:0
DEBU HISTCONTROL=ignoredups
DEBU HISTFILE is unset
DEBU HISTFILESIZE is unset
DEBU HISTIGNORE is unset
DEBU HISTSIZE=1000
DEBU HISTTIMEFORMAT is unset
DEBU HOME=/home/ebendler
DEBU KDE_FULL_SESSION=true
DEBU KDE_SESSION_VERSION=6
DEBU KONSOLE_DBUS_SESSION is unset
DEBU KONSOLE_DBUS_WINDOW is unset
DEBU KONSOLE_PROFILE_NAME is unset
DEBU KONSOLE_VERSION is unset
DEBU LANG=en_US.UTF-8
DEBU SHELL=/bin/bash
DEBU SSH_AUTH_SOCK=/home/ebendler/.ssh/agent/s.ONHeZyMUiZ.agent.DuH1cHb7Gz
DEBU TERM=xterm-kitty
DEBU TOOLBOX_PATH=/usr/bin/toolbox
DEBU USER=ebendler
DEBU VTE_VERSION is unset
DEBU WAYLAND_DISPLAY=wayland-0
DEBU XAUTHORITY=/run/user/361934436/xauth_eAJubT
DEBU XDG_CACHE_HOME is unset
DEBU XDG_CONFIG_HOME is unset
DEBU XDG_CURRENT_DESKTOP=KDE
DEBU XDG_DATA_DIRS=/home/ebendler/.local/share/flatpak/exports/share:/var/lib/flatpak/exports/share:/usr/local/share:/usr/share
DEBU XDG_DATA_HOME is unset
DEBU XDG_MENU_PREFIX=plasma-
DEBU XDG_RUNTIME_DIR=/run/user/361934436
DEBU XDG_SEAT=seat0
DEBU XDG_SESSION_CLASS=user
DEBU XDG_SESSION_DESKTOP=KDE
DEBU XDG_SESSION_ID=4
DEBU XDG_SESSION_TYPE=wayland
DEBU XDG_STATE_HOME is unset
DEBU XDG_VTNR=2
DEBU XTERM_VERSION is unset
DEBU NVIDIA_VISIBLE_DEVICES=void
DEBU P11_KIT_SERVER_ADDRESS=unix:path=/run/user/361934436/toolbox/pkcs11
DEBU Running in container ubuntu-toolbox-26.04:
DEBU podman
DEBU --log-level
DEBU error
DEBU exec
DEBU --detach-keys
DEBU
DEBU --env=COLORTERM=truecolor
DEBU --env=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/361934436/bus
DEBU --env=DESKTOP_SESSION=/usr/share/wayland-sessions/plasma.desktop
DEBU --env=DISPLAY=:0
DEBU --env=HISTCONTROL=ignoredups
DEBU --env=HISTSIZE=1000
DEBU --env=HOME=/home/ebendler
DEBU --env=KDE_FULL_SESSION=true
DEBU --env=KDE_SESSION_VERSION=6
DEBU --env=LANG=en_US.UTF-8
DEBU --env=SHELL=/bin/bash
DEBU --env=SSH_AUTH_SOCK=/home/ebendler/.ssh/agent/s.ONHeZyMUiZ.agent.DuH1cHb7Gz
DEBU --env=TERM=xterm-kitty
DEBU --env=TOOLBOX_PATH=/usr/bin/toolbox
DEBU --env=USER=ebendler
DEBU --env=WAYLAND_DISPLAY=wayland-0
DEBU --env=XAUTHORITY=/run/user/361934436/xauth_eAJubT
DEBU --env=XDG_CURRENT_DESKTOP=KDE
DEBU --env=XDG_DATA_DIRS=/home/ebendler/.local/share/flatpak/exports/share:/var/lib/flatpak/exports/share:/usr/local/share:/usr/share
DEBU --env=XDG_MENU_PREFIX=plasma-
DEBU --env=XDG_RUNTIME_DIR=/run/user/361934436
DEBU --env=XDG_SEAT=seat0
DEBU --env=XDG_SESSION_CLASS=user
DEBU --env=XDG_SESSION_DESKTOP=KDE
DEBU --env=XDG_SESSION_ID=4
DEBU --env=XDG_SESSION_TYPE=wayland
DEBU --env=XDG_VTNR=2
DEBU --env=NVIDIA_VISIBLE_DEVICES=void
DEBU --env=P11_KIT_SERVER_ADDRESS=unix:path=/run/user/361934436/toolbox/pkcs11
DEBU --interactive
DEBU --preserve-fds
DEBU 0
DEBU --tty
DEBU --user
DEBU ebendler
DEBU --workdir
DEBU /home/ebendler
DEBU ubuntu-toolbox-26.04
DEBU capsh
DEBU --caps=
DEBU --
DEBU -c
DEBU exec "$@"
DEBU bash
DEBU /bin/bash
DEBU -l

[tghuguenin]

same is happening to me as well. for a workaround i use su to become root then passwd username to set a password.

[NewtonChutney]

Issue also present in Ubuntu 25.10

[NewtonChutney]

Upon investigating, it looks like the sudo-rs implementation is to blame.
We will need this block to fix the issue..

# Allow passwordless sudo for the sudo group
RUN echo "%sudo ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/90-toolbx-nopasswd

[foriequal0]

Switching to the original sudo until the issue is resolved is also possible choice.

# run once inside the shell in the toolbx.
su -c 'update-alternatives --set sudo /usr/bin/sudo.ws'